cognium-dev 4.9.10 → 4.9.12

package/dist/cli.js

@@ -5338,6 +5338,27 @@ var CSHARP_COMMAND_EXECUTE_METHODS = new Set([
   "ExecuteReaderAsync",
   "ExecuteNonQueryAsync"
 ]);
+var CSHARP_RECEIVER_URL_METHODS = new Set([
+  "GetAsync",
+  "PostAsync",
+  "PutAsync",
+  "PatchAsync",
+  "DeleteAsync",
+  "HeadAsync",
+  "GetStringAsync",
+  "GetByteArrayAsync",
+  "GetStreamAsync",
+  "GetJsonAsync"
+]);
+var CSHARP_HEADER_RECEIVER_RE = /(^|\.)Headers$/;
+function csharpBareName(node) {
+  if (node.type === "generic_name") {
+    const id = node.childForFieldName("name") ?? node.namedChild(0);
+    if (id)
+      return getNodeText(id);
+  }
+  return getNodeText(node);
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5349,16 +5370,22 @@ function extractCSharpCalls(tree, cache) {
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
-      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
     } else if (fn) {
-      methodName = getNodeText(fn);
+      methodName = csharpBareName(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
     let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
     if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
       args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
     }
+    if (methodName === "Add" && receiver && CSHARP_HEADER_RECEIVER_RE.test(receiver)) {
+      methodName = "AddHeader";
+    }
+    if (receiver && args2.length === 0 && CSHARP_RECEIVER_URL_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+    }
     calls.push({
       method_name: methodName,
       receiver,
@@ -5374,7 +5401,7 @@ function extractCSharpCalls(tree, cache) {
     const typeNode = creation.childForFieldName("type");
     const argsNode = creation.childForFieldName("arguments");
     calls.push({
-      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      method_name: typeNode ? csharpBareName(typeNode) : "unknown",
       receiver: null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -5387,6 +5414,41 @@ function extractCSharpCalls(tree, cache) {
   const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
   for (const asn of assignments) {
     const left = asn.childForFieldName("left");
+    if (left?.type === "element_access_expression") {
+      const target = left.childForFieldName("expression");
+      const right2 = asn.childForFieldName("right");
+      if (!target || !right2)
+        continue;
+      if (!CSHARP_HEADER_RECEIVER_RE.test(getNodeText(target)))
+        continue;
+      const subscript = left.childForFieldName("subscript") ?? left.namedChild(1);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: "AddHeader",
+        receiver: getNodeText(target),
+        receiver_type: null,
+        receiver_type_fqn: null,
+        arguments: [
+          {
+            position: 0,
+            expression: subscript ? getNodeText(subscript) : "",
+            variable: null,
+            literal: subscript ? getNodeText(subscript) : null,
+            value: null
+          },
+          {
+            position: 1,
+            expression: rhsText2,
+            variable: right2.type === "identifier" ? rhsText2 : null,
+            literal: right2.type === "string_literal" ? rhsText2 : null,
+            value: null
+          }
+        ],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression")
       continue;
     const nameNode = left.childForFieldName("name");
@@ -12474,6 +12536,17 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Query", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirst", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefaultAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingle", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingleOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryMultiple", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Filter", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12515,12 +12588,16 @@ var DEFAULT_SINKS = [
   { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetJsonAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PatchAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HeadAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
   { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12538,6 +12615,7 @@ var DEFAULT_SINKS = [
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Format", class: "String", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12546,12 +12624,18 @@ var DEFAULT_SINKS = [
   { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "BsonJavaScript", class: "constructor", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "LogInformation", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogWarning", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogError", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "IsMatch", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Match", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Matches", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Replace", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Regex", class: "constructor", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12691,6 +12775,8 @@ var DEFAULT_SANITIZERS = [
   { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "IsLocalUrl", removes: ["open_redirect"] },
+  { method: "LocalRedirect", removes: ["open_redirect"] },
   { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
@@ -13106,6 +13192,22 @@ var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.path_params\b/, sourceType: "http_param" },
   { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
+function dropCSharpObjectCarriedWaypoints(sinks, calls) {
+  const zeroArgCtors = new Set;
+  for (const call of calls) {
+    if (call.is_constructor && call.arguments.length === 0) {
+      zeroArgCtors.add(`${call.location.line}:${call.method_name}`);
+    }
+  }
+  return sinks.filter((sink) => {
+    if (sink.type !== "sql_injection")
+      return true;
+    if (sink.method && zeroArgCtors.has(`${sink.line}:${sink.method}`)) {
+      return false;
+    }
+    return true;
+  });
+}
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== undefined ? code.split(`
 `) : undefined;
@@ -13113,8 +13215,9 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
+  const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
-  return { sources, sinks, sanitizers };
+  return { sources, sinks: gatedSinks, sanitizers };
 }
 function sinkPatternAppliesTo(pattern, language) {
   if (language === undefined)
@@ -13399,7 +13502,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   const sourceMap = new Map;
   for (const source of sources) {
-    const key = `${source.line}:${source.type}`;
+    const key = source.type === "interprocedural_param" && source.variable ? `${source.line}:${source.type}:${source.variable}` : `${source.line}:${source.type}`;
     const existing = sourceMap.get(key);
     if (!existing || source.confidence > existing.confidence) {
       sourceMap.set(key, source);
@@ -14077,6 +14180,19 @@ var CWE_78_RECEIVER_ALLOWLIST = new Set([
   "ProcessExecutor",
   "RuntimeUtil"
 ]);
+function isRegexReceiver(receiver, sourceLines) {
+  const r = (receiver ?? "").trim();
+  if (r.length === 0)
+    return false;
+  if (r.startsWith("/") && /\/[a-z]*$/.test(r))
+    return true;
+  if (/^(?:new\s+)?RegExp\s*\(/.test(r))
+    return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r) || !sourceLines)
+    return false;
+  const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
+  return sourceLines.some((l) => decl.test(l));
+}
 function isFunctionCallbackArgument(arg) {
   if (arg.literal !== null && arg.literal !== undefined)
     return false;
@@ -14284,6 +14400,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (pattern.type === "command_injection" && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
+        if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
+          continue;
+        }
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -15388,12 +15510,12 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
 // node_modules/circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string", "prompt_injection"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection", "log_injection"],
@@ -17801,6 +17923,9 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
   for (const source of sources) {
     const defsOnLine = defsByLine.get(source.line) ?? [];
     for (const def of defsOnLine) {
+      if (source.type === "interprocedural_param" && source.variable && def.kind === "param" && def.variable !== source.variable) {
+        continue;
+      }
       tainted.push({
         variable: def.variable,
         defId: def.id,
@@ -23170,13 +23295,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "format!",
-        type: "format_string",
-        cwe: "CWE-134",
-        severity: "medium",
-        argPositions: [0]
-      },
       {
         method: "from_raw_parts",
         type: "unsafe_memory",
@@ -26134,12 +26252,21 @@ function findCSharpRequestSources(sourceCode, language) {
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
+  const formFileParams = new Set;
+  const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+  for (const line of lines) {
+    const re = new RegExp(formFileDeclRe.source, "g");
+    let d;
+    while ((d = re.exec(line)) !== null)
+      formFileParams.add(d[1]);
+  }
+  const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m)
       continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : formFileReadRe?.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type)
       continue;
     const lineNumber = i2 + 1;
@@ -35729,7 +35856,7 @@ class TaintPropagationPass {
     for (const f of paramFlows) {
       pushIfNew(f);
     }
-    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language) ?? [];
+    const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language, types) ?? [];
     for (const f of exprScanFlows) {
       if (flowKeys.has(flowKey(f)))
         continue;
@@ -35893,6 +36020,35 @@ class TaintPropagationPass {
         return bestByKey.get(key) === f;
       });
     }
+    if (ctx.language === "csharp" && finalFlows.length > 1) {
+      const CSHARP_ADO_EXECUTE = /^Execute(?:Reader|NonQuery|Scalar)(?:Async)?$/;
+      const commandTextReceiverByLine = new Map;
+      const execLinesByReceiver = new Map;
+      for (const call of calls) {
+        const receiver = (call.receiver ?? "").trim();
+        if (!receiver)
+          continue;
+        if (call.method_name === "CommandText") {
+          commandTextReceiverByLine.set(call.location.line, receiver);
+        } else if (CSHARP_ADO_EXECUTE.test(call.method_name)) {
+          const lines = execLinesByReceiver.get(receiver) ?? [];
+          lines.push(call.location.line);
+          execLinesByReceiver.set(receiver, lines);
+        }
+      }
+      if (commandTextReceiverByLine.size > 0) {
+        const reportedSqlSinkLines = new Set(finalFlows.filter((f) => f.sink_type === "sql_injection").map((f) => f.sink_line));
+        finalFlows = finalFlows.filter((f) => {
+          if (f.sink_type !== "sql_injection")
+            return true;
+          const receiver = commandTextReceiverByLine.get(f.sink_line);
+          if (receiver === undefined)
+            return true;
+          const execLines = execLinesByReceiver.get(receiver) ?? [];
+          return !execLines.some((line) => line > f.sink_line && reportedSqlSinkLines.has(line));
+        });
+      }
+    }
     return { flows: finalFlows };
   }
 }
@@ -36359,7 +36515,7 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   }
   return false;
 }
-function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language) {
+function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
   const sourcesWithVar = sources.filter((s) => typeof s.variable === "string" && s.variable.length > 0);
   const aliasSanitizedFor = new Map;
@@ -36642,13 +36798,37 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         if (s.line < anchor.line)
           anchor = s;
       }
+      const methodAt = (line) => {
+        for (const t of types ?? []) {
+          for (const m of t.methods) {
+            if (line >= m.start_line && line <= m.end_line)
+              return m.name;
+          }
+        }
+        return null;
+      };
       const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
-      for (const [varName] of derived) {
+      for (const [varName, derivedLine] of derived) {
         if (!varName || existingVars.has(varName))
           continue;
+        const owner = methodAt(derivedLine);
+        let scopedAnchor = anchor;
+        if (owner) {
+          let best;
+          for (const s of sourcesWithVar) {
+            const sOwner = s.in_method ?? methodAt(s.line);
+            if (sOwner !== owner)
+              continue;
+            if (!best || s.line < best.line)
+              best = s;
+          }
+          if (best)
+            scopedAnchor = best;
+        }
         sourcesWithVar.push({
-          ...anchor,
-          variable: varName
+          ...scopedAnchor,
+          variable: varName,
+          ...owner ? { in_method: owner } : {}
         });
         existingVars.add(varName);
       }
@@ -48398,6 +48578,13 @@ function mergeMavenInheritance(modules, scanRoot) {
       byBuildFile.set(normalize(m.buildFile), m);
     }
   }
+  const ownSignals = new Map;
+  for (const [buildFile, m] of byBuildFile) {
+    ownSignals.set(buildFile, {
+      urls: [...m.signals.distributionUrls],
+      plugins: [...m.signals.plugins]
+    });
+  }
   for (const child of modules) {
     if (child.buildSystem !== "maven")
       continue;
@@ -48405,7 +48592,7 @@ function mergeMavenInheritance(modules, scanRoot) {
       continue;
     const inheritedUrls = new Set;
     const inheritedPlugins = new Set;
-    walkParents(child, byBuildFile, normalizedScanRoot, inheritedUrls, inheritedPlugins);
+    walkParents(child, byBuildFile, ownSignals, normalizedScanRoot, inheritedUrls, inheritedPlugins);
     if (inheritedUrls.size === 0 && inheritedPlugins.size === 0)
       continue;
     const existingUrls = new Set(child.signals.distributionUrls);
@@ -48420,7 +48607,7 @@ function mergeMavenInheritance(modules, scanRoot) {
     }
   }
 }
-function walkParents(start2, byBuildFile, scanRoot, outUrls, outPlugins) {
+function walkParents(start2, byBuildFile, ownSignals, scanRoot, outUrls, outPlugins) {
   const visited = new Set([normalize(start2.buildFile)]);
   let current = start2;
   for (let depth = 0;depth < MAX_DEPTH; depth++) {
@@ -48442,10 +48629,13 @@ function walkParents(start2, byBuildFile, scanRoot, outUrls, outPlugins) {
     const parent = byBuildFile.get(parentBuildFile);
     if (!parent)
       return;
-    for (const u of parent.signals.distributionUrls)
-      outUrls.add(u);
-    for (const p of parent.signals.plugins)
-      outPlugins.add(p);
+    const parentOwn = ownSignals.get(parentBuildFile);
+    if (parentOwn) {
+      for (const u of parentOwn.urls)
+        outUrls.add(u);
+      for (const p of parentOwn.plugins)
+        outPlugins.add(p);
+    }
     current = parent;
   }
 }
@@ -48821,7 +49011,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.10";
+var version = "4.9.12";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49374,8 +49564,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "132eaf6",
-  builtAt: "2026-09-02T06:21:26.855Z"
+  gitSha: "344dd1f",
+  builtAt: "2026-09-10T17:10:54.335Z"
 };
 
 // src/utils/args.ts
@@ -49719,6 +49909,22 @@ var LANG_MAP = {
   ".html": "html",
   ".htm": "html"
 };
+var VULN_SEVERITY_RANK = { critical: 3, high: 2, medium: 1, low: 0 };
+function dedupeVulnerabilities(vulns) {
+  const best = new Map;
+  const order = [];
+  for (const v of vulns) {
+    const key = `${v.type}:${v.line}`;
+    const current = best.get(key);
+    if (current === undefined) {
+      best.set(key, v);
+      order.push(key);
+    } else if ((VULN_SEVERITY_RANK[v.severity] ?? -1) > (VULN_SEVERITY_RANK[current.severity] ?? -1)) {
+      best.set(key, v);
+    }
+  }
+  return order.map((k) => best.get(k));
+}
 function detectLanguage7(filePath) {
   const ext = extname(filePath).toLowerCase();
   return LANG_MAP[ext] || null;
@@ -49813,7 +50019,7 @@ async function scanFile(filePath, language, analyzeOpts) {
         ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
-    return { file: filePath, vulnerabilities };
+    return { file: filePath, vulnerabilities: dedupeVulnerabilities(vulnerabilities) };
   } catch (error) {
     return {
       file: filePath,
@@ -49856,7 +50062,7 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
         ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
-    return { file, vulnerabilities };
+    return { file, vulnerabilities: dedupeVulnerabilities(vulnerabilities) };
   });
   return {
     results,
@@ -50756,6 +50962,7 @@ export {
   loadConfig,
   isTestFile2 as isTestFile,
   detectLanguage7 as detectLanguage,
+  dedupeVulnerabilities,
   convertConfigToPassOptions,
   applySuppressionsToResults,
   PASS_REGISTRY

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.10",
+  "version": "4.9.12",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,7 +14,7 @@
     "test": "bun test",
     "clean": "rm -rf dist cognium-dev cognium-dev-* *.bun-build wasm",
     "typecheck": "tsc --noEmit",
-    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually — use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
+    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually \u2014 use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
     "dogfood": "bun run src/cli.ts scan src/ -q",
     "prepublishOnly": "bun run build"
   },
@@ -65,8 +65,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@cognium/project-profile-detect": "1.1.0",
-    "circle-ir": "4.9.10"
+    "@cognium/project-profile-detect": "1.1.1",
+    "circle-ir": "4.9.12"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",